Valid PCSAE Exam Dumps are Your best Choice to Pass

1. In which two locations can filters and transformers be used in XSOAR? (Choose two.)

2. Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

3. When creating a new tab in the layout, which section cannot be added?

4. An engineer is developing a playbook that will be run multiple times for testing purposes.

What is the recommended first task to be used in the playbook?

5. A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days.

What is the correct query to use?

6. What assigns newly ingested event attributes to incident fields?

7. What are two primary uses of standard tasks? (Choose two.)

8. What is the default configuration for indicator auto-extraction when incidents are created?

9. During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.

Which of the following set of steps can help to resolve the issue?

10. When developing the playbook, which of the following can be used by a XSOAR Administrator?

11. An analyst runs the following command in a playbook task:

!ip ip=1.1.1.1

Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

12. Email Subject C “You have won a million dollars”

What is the correct query syntax for the above incident search filter?

13. Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?

14. 1.Reliability scores in XSOAR range from A through F.

What do A and F stand for?

15. The default expiration method for non-feed indicators is either to never expire or to expire after a specific period of time.

How frequently does XSOAR check tor newly expired indicators?

16. For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

17. An engineer would like to present a trend using widgets to compare to a previous week’s data.

Which two methods will allow the engineer to meet the requirement? (Choose two.)

18. Which two statements accurately describe layouts? (Choose two.)

19. Given the following context data, what would be the expected output of the expression?

20. An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:





The organization wants to use the mail server location on the subsidiary's cloud to send emails.

Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

21. What can be added to offload integration instance processing from the main server?

22. When creating an incident layout section, it is best to place long field values within which of the following?

23. Which two capabilities do Automation script settings include? (Choose two.)

24. Which of the following is a basic setting that can be configured in an automation?

25. What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

26. You need to retrieve a list of all malicious hashes over the last 30 days.

What is the correct query to use?

27. Which task type would be used to verify/check that an integration was enabled?

28. An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields.

How can this task be achieved?

29. Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)

30. Where are incident layouts customized?

31. What are three different loop types in a playbook? (Choose three.)

32. Which field type provides an interactive and editable display of table-based data?

33. Which configuration is a valid distributed database (DB) implementation?

34. Who is permitted to create and submit content to the Marketplace?

35. An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically.

How can this be implemented?

36. What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

37. What will happen if a playbook debugger is left running for more than 24 hours?

38. DRAG DROP

Match the operations with the appropriate context.

39. Which investigation element is best suited for collaboration among users?

40. What can you use to assign a layout, field, and playbook to an incoming incident?

41. An administrator has noticed that an integration has failed to fetch incidents.

Where would they go to download logs to troubleshoot the error?

42. What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

43. An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.

Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

44. Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.

After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

45. What happens when an integration is deprecated?

46. Whar are possible war room result (entry) types?

47. Which three authentication methods are supported when logging into XSOAR? (Choose three.)

48. Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?